CVE-2026-49175 Overview
CVE-2026-49175 is a heap-based buffer overflow vulnerability in the Windows Domain Name System (DNS) component. An authorized local attacker can exploit the flaw to elevate privileges on affected Windows client and server systems. Microsoft published the advisory on 2026-07-14 and last updated it on 2026-07-20.
The vulnerability affects Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025. Successful exploitation grants the attacker code execution in a higher-privileged context, breaking the local privilege boundary. The weakness is classified under [CWE-122] (Heap-based Buffer Overflow).
Critical Impact
A low-privileged local user can trigger a heap overflow in Windows DNS to gain elevated privileges, resulting in complete confidentiality, integrity, and availability compromise of the host.
Affected Products
- Microsoft Windows 10 21H2 and 22H2 (x86, x64, ARM64)
- Microsoft Windows 11 24H2, 25H2, and 26H1 (x64, ARM64)
- Microsoft Windows Server 2022 and Windows Server 2025
Discovery Timeline
- 2026-07-14 - CVE-2026-49175 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-49175
Vulnerability Analysis
The vulnerability resides in the Windows DNS component and stems from improper bounds checking when allocating or copying data on the heap. An authorized local user with low privileges can craft input that overruns a heap-allocated buffer within the DNS service context. The overflow corrupts adjacent heap metadata or objects, allowing the attacker to influence execution flow.
Because the DNS service runs with elevated privileges, a successful overflow permits privilege escalation to the service account context. The attack requires local access and low complexity, with no user interaction. The impact spans confidentiality, integrity, and availability of the affected system.
EPSS currently rates the exploitation probability at 0.245% (15.8th percentile), and no public proof-of-concept has been observed at the time of writing.
Root Cause
The root cause is a heap-based buffer overflow [CWE-122] in the Windows DNS code path. The vulnerable routine writes attacker-controlled data past the end of a heap allocation, corrupting adjacent memory. Microsoft has not disclosed the specific function or structure involved.
Attack Vector
The attack vector is local. An attacker must already possess valid credentials on the target system. The attacker sends specially crafted requests or input to the DNS component from the local machine. No user interaction is required to trigger the overflow.
Detailed exploitation code is not publicly available. Refer to the Microsoft Security Response Center advisory for vendor-provided technical context.
Detection Methods for CVE-2026-49175
Indicators of Compromise
- Unexpected crashes or restarts of the DNS service (dns.exe) accompanied by Windows Error Reporting entries referencing heap corruption.
- Creation of new privileged processes or services spawned as children of the DNS service process.
- Anomalous local user activity interacting with DNS management interfaces prior to service faults.
Detection Strategies
- Monitor the Windows Event Log for Application Error events (Event ID 1000) and Service Control Manager events (Event ID 7031/7034) tied to the DNS service.
- Deploy behavioral endpoint detection rules that flag privilege escalation patterns originating from the DNS service context.
- Correlate local logon events with subsequent DNS service crashes to identify suspicious sequences.
Monitoring Recommendations
- Enable Windows process creation auditing (Event ID 4688) and track child processes of dns.exe.
- Ingest DNS server operational and analytical logs into a centralized log platform for retrospective hunting.
- Alert on unexpected local account activity on domain controllers and DNS servers.
How to Mitigate CVE-2026-49175
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-49175 to all affected Windows 10, Windows 11, and Windows Server systems.
- Prioritize patching on domain controllers and any systems running the DNS Server role.
- Restrict local logon rights on DNS servers to the minimum set of administrative users.
- Review recent local account activity on affected hosts for signs of exploitation.
Patch Information
Microsoft has released security updates for all affected Windows versions. Consult the Microsoft Security Response Center guidance for CVE-2026-49175 for the applicable Knowledge Base (KB) articles and cumulative update packages per platform.
Workarounds
- No official workaround has been published by Microsoft; patching is the recommended remediation.
- Where immediate patching is not feasible, limit interactive and remote local logon access to DNS servers to trusted administrators only.
- Apply strict Role-Based Access Control (RBAC) and just-in-time administration to reduce the pool of accounts that could exploit the flaw locally.
# Verify installed updates on a Windows host and check DNS service status
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
Get-Service -Name DNS | Format-List Name, Status, StartType
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
